pass URLs via javascript now; add text/xml as allowed mirrored file